CVE-2024-25623

CVE-2024-25623 describes a lack of verification of the Activity Streams Content-Type when Mastodon fetches remote statuses, enabling impersonation of accounts on remote servers that allow registering and arbitrary user uploads. Affected versions are prior to 4.2.7, 4.1.15, 4.0.15, and 3.5.19. The...

CVE-2023-6072

A cross-site scripting vulnerability in Trellix Central Management CM prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard...

Remote Content Shortcode <= 1.5 - Authenticated(Contributor+) Local File Inclusion via shortcode

Description The Remote Content Shortcode plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.5 via the plugin's shortcode. This allows authenticated attackers with contributor-level privileges and above to include and execute arbitrary files on the serve...

WordPress Remote Content Shortcode Plugin <= 1.5 is vulnerable to Local File Inclusion

Software Remote Content Shortcode Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-45652 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6e56401bc4b5 Credits Mika Required privilege Contributor...

SUSE CVE-2023-3740

Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL. Chromium security severity: Low...

CVE-2023-1895

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the getremotecontent REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary...

CVE-2023-1895

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the getremotecontent REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary...

Getwid < 1.8.4 - Subscriber+ SSRF

The plugin does not validate a parameter via the getremotecontent REST API endpoint before making a request to it, which could allow any authenticated users, such as subscriber to perform SSRF attack. Note: We do not consider flushing of cache to be a security issue, therefore CVE-2023-1910 has n...

WordPress Plugin Gutenberg Blocks 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2023-18363 · Webkitgtk +4 · Webkitgtk +4

Name of the Vulnerable Software and Affected Versions: WebKitGTK affected versions not specified Description: A flaw was found in the WebKitGTK package due to an improper input validation issue, which may lead to a use-after-free issue. This allows attackers with network access to pass specially...

SUSE CVE-2018-5184

Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR 52.8 and Thunderbird 52.8...

Apache Sling 注入漏洞

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

USN-5824-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

McAfee Skyhigh Secure Web Gateway 跨站脚本漏洞

McAfee Skyhigh Secure Web Gateway McAfee Skyhigh SWG is a series of security gateways from McAfee, Inc. A security vulnerability in McAfee Skyhigh Secure Web Gateway versions 10.x prior to 10.2.17 and 11.x prior to 11.2.6 and 12.x prior to 12.0.1 stems from a vulnerability that could allow a remo...

SUSE-SU-2022:4636-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to version 102.6.1 fixed: Remote content did not load in user-defined signatures fixed: Addons that added new action buttons were not shown for addon upgrades, requiring removal and reinstall fixed: Various stability improvemen...

CVE-2022-45414

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block...

CVE-2022-45414

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block...

CVE-2022-3033

If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the http-equiv="refresh" attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. I...

CVE-2022-45414

If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block...

CVE-2022-45414

CVE-2022-45414 is a Thunderbird HTML-email parsing vulnerability. When a user quotes an HTML message containing a VIDEO tag with a POSTER attribute or an OBJECT tag with a DATA attribute, Thunderbird could perform a network request to the remote URL and display an image loaded from the POSTER in ...